feat: one download address per channel that never changes

https://updates.riverofglorymn.org/stable/latest.deb
  https://updates.riverofglorymn.org/canary/latest.deb

A symlink beside each channel's manifest, pointing at the versioned
package the manifest names. Deliberately not a second record of which
version is current — the manifest stays the only answer to that, and the
publish scripts derive the pointer from it rather than from anything they
know themselves.

The versioned files are never rewritten. A release uploads its package,
then the manifest, then swaps the pointer by rename. Atomic, so nothing
downloads a half-written pointer; and last, so the pointer can lag the
manifest by a moment and can never lead it. A pointer that led the
manifest would offer a package the channel had not published.

Both latest.deb and manifest.json are served no-store on the update
server. Cloudflare sits in front of it and caches .deb by extension, so
without that header a room could be handed the previous release from an
edge for hours. The versioned packages keep no such header because they
are immutable and worth caching.

The server change is one matcher in the Caddyfile's updates block, and it
took three attempts to land for a reason worth recording: the Caddyfile is
a FILE bind mount, so `mv` over it replaces the inode and the container
goes on serving the old one. Two apparently successful reloads changed
nothing. It is written through the mount now, and the host copy is
identical so the next container restart is a no-op. Caddy was reloaded,
never restarted; the church's other sites were not interrupted.

Installing from a channel URL still does not move a machine onto that
channel. CHANNEL in device.conf decides which manifest the updater
follows, and the postinst only appends settings that are missing, so
fetching the canary package by hand to repair a machine leaves it on
stable.

Verified end to end against the live server: both URLs deliver bytes whose
sha256 matches their channel's manifest, both carry the no-store header,
and the versioned package does not.

Co-Authored-By: Claude Opus 5 <[email protected]>

update_canary.sh

@@ -70,6 +70,30 @@ rsync -av \
     "$ROOT/repo/canary/manifest.json" \
     classroom-control:/srv/ekklesia/classroom-updates/canary/manifest.json
 
+
+# THE PERMANENT URL.
+#
+# .../canary/latest.deb is a symlink beside the manifest pointing at the
+# versioned package the manifest names, so there is one download address
+# that never changes and still no second place recording which version is
+# current. The manifest remains the only answer to that question.
+#
+# It is swapped AFTER the manifest, and by rename, for two reasons. A
+# rename is atomic, so nothing ever downloads a half-written pointer; and
+# going last means latest.deb can only ever lag the manifest by a moment,
+# never lead it — it can never offer a package the channel has not
+# published. The versioned file itself is never touched again once
+# uploaded.
+ssh classroom-control "
+    set -e
+    cd /srv/ekklesia/classroom-updates/canary
+    test -f ../packages/$package_name
+    ln -sfn ../packages/$package_name latest.deb.new
+    mv -Tf latest.deb.new latest.deb
+"
+
+echo "https://updates.riverofglorymn.org/canary/latest.deb -> $package_name"
+
 echo
 echo "Published Ekklesia Classroom $version to CANARY"
 echo "https://updates.riverofglorymn.org/canary/manifest.json"